IntroductionZscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. First observed in late September 2026, the campaign affected multiple South Korean fi…
Key findings A disruption action targeting prominent players across the Chinese-speaking phishing and fraud ecosystem struck a blow to the most high-volume threats in Proofpoint data. Proofpoint supported Microsoft and other private and public partners in the civil lawsuit and takedown action. The highest-volume direct email threats in Proofpoint campaign data come from three phishing kits our researchers named CoGUI…
Do you want ants? Because this is how you get ants. Executive Summary On the night of 11 October, attackers switched hundreds of French supermarket fridges into defrost mode. If that sounds familiar: in August, the Department of Defense confirmed refrigeration disruptions at US military commissaries, where at least one base reported that all its […] The post Frostbitten in France: A Danfoss StoreView Internet Exposur…
Talos and Recorded Future identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Recovered artifacts show additional interest in water resources and energy.
In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally. The post Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem appeared first on CyberScoop.
I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed1, fewer than half used lockfiles that checked for tampering by default, a…
A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance. “In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4)…
Microsoft released a record-shattering 1,407 CVEs to be plugged today on October Patch Tuesday, breaking the 2020 record of 1,261. The list was so long that its release was several hours later than the usual 1 p.m. Eastern drop time, somewhat frustrating admins. The bugs include three zero-day vulnerabilities, one of which has been exploited. The zero day being exploited, and that should be dealt with immediately, is…
OverviewOn October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited numbe…
Critical infrastructure faces mounting threats from nation-state groups and AI-driven attacks. In the latest installment of our Cybersecurity Awareness Month blog series, learn how leading cybersecurity agencies, such as CISA, are advising critical infrastructure organizations on ways to protect themselves and the essential services they provide.Key takeawaysCritical infrastructure organizations often struggle with a…
New research examines the challenges shaping enterprise threat intelligence programs, what teams are prioritizing for the months ahead, and how they are approaching agentic AI plans and budgets. The post The Enterprise Threat Intelligence Report: 2026 appeared first on Flashpoint.
Singapore opened SICW 2026 with a blunt message: no government, company or country can see the full picture of today's cyber threats, and artificial intelligence is now raising the stakes for defenders and attackers alike. Speaking at the opening ceremony of the 11th Singapore International Cyber Week on 13 October 2026, Gwenda Fong, Commissioner of Cybersecurity and Chief Executive of the Cyber Security Agency of Si…
For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier. The incident reportedly exposed personal information, including names, addresses, and […] The post 12th…
A new Kerala Police MoU will bring threat intelligence into cybercrime investigations in the state. Cyble, an AI-native cybersecurity company, has signed a three-year Memorandum of Understanding with Kerala Police that covers intelligence support, investigative assistance and capacity building. The agreement was signed through Cyble's Indian subsidiary, Cyble Infosec India Private Limited. It will support the Kerala…
